16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
OpenSourceMalware discovered a typosquatting campaign on August 15, 2026, tracked as StubMaker, publishing 16 malicious RubyGems packages (e.g., ubnuler, brumdler, brundlef) that imitate popular Ruby dependencies. The gems use the extconf.rb install hook to fetch a 22 MB Rust-based loader from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL that bypasses Chromium's app-bound encryption to extract browser credentials, payment cards, crypto wallets and seed phrases, and Telegram Desktop data. Stolen data is uploaded as a password-protected ZIP to Gofile, with the download link sent over plain HTTP. The same actor also deployed 37 typosquatted npm packages delivering the identical loader and infostealer, and abused RubyGems' namespace reuse to republish malicious versions of yanked gems.
- 16 typosquatted RubyGems gems, including fake bundler and i18n variants, were published and later yanked.
- Install-time extconf.rb hook downloads a Rust loader from GitHub that launches a Go infostealer.
- Malware bypasses Chromium app-bound encryption to steal passwords, cookies, cards, wallets, and Telegram data.
- Attacker abused RubyGems namespace reuse after gem yanking to republish malicious versions under the same names.
- Same actor ran a parallel npm campaign with 37 packages sharing the loader and C2 backend.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1105 Ingress Tool TransferT1555.003 Credentials from Web BrowsersT1539 Steal Web Session CookieT1567.002 Exfiltration to Cloud Storage
- Threat actors
- StubMaker
- Malware
- wincfgabe_payload.dll
- Organizations
- OpenSourceMalwareSafeDep
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.